[outages] Dynect.net - DNS Trouble from Comcast Business Michigan?

[Matt Freitag]

There's a large-scale DDoS attack happening against Dyn's name servers,
news about it is also on the NANOG list:

http://gizmodo.com/this-is-probably-why-half-the-internet-shut-down-today-1788062835
https://www.dynstatus.com/incidents/nlr4yrr162t8

Matt Freitag
Network Engineer I
Information Technology
Michigan Technological University
(906) 487-3696 <%28906%29%20487-3696>
https://www.mtu.edu/
https://www.it.mtu.edu/

On Fri, Oct 21, 2016 at 9:11 AM, Mike Phipps via Outages <
outages at outages.org> wrote:

> Is anyone else who is on Comcast Business Class in the Detroit, MI area
> having issues with sites that use DYNECT.NET for serving their DNS zone
> files? I found that I could not reach any name server at DYNECT.NET, so
> it was causing sites like wikia.com, theverge.com, theguardian.com, &c to
> fail for me. It was like that for about 10 minutes, but it just recently
> started working.
>
> It works fine from a DigitalOcean VPS that I control. However, I also
> checked from my WOW connection at home (also in the Detroit area), and it
> is slow to respond from there. At least it works, though. Looks like it's
> dying within AS15135 (EveryDNS).
>
>
> $ whois theverge.com
>
> [...]
>    Name Server: NS1.P16.DYNECT.NET
>    Name Server: NS2.P16.DYNECT.NET
>    Name Server: NS3.P16.DYNECT.NET
>    Name Server: NS4.P16.DYNECT.NET
> [...]
>
> # this was from my home WOW connection
> $ traceroute ns1.p16.dynect.net
> traceroute to ns1.p16.dynect.net (208.78.70.16), 30 hops max, 60 byte
> packets
>  1  router.asus.com (172.23.240.1)  0.553 ms  0.530 ms  0.511 ms
>  2  d149-67-1-112.try.wideopenwest.com (67.149.112.1)  9.353 ms  9.339
> ms  9.660 ms
>  3  dynamic-76-73-172-25.knology.net (76.73.172.25)  8.480 ms  11.207 ms
> 11.191 ms
>  4  76-73-165-180.knology.net (76.73.165.180)  11.172 ms  11.137 ms
> 11.118 ms
>  5  xe-11-1-0.edge2.Chicago2.Level3.net (4.53.74.117)  11.742 ms  11.724
> ms  11.705 ms
>  6  NTT-level3-90G.NewYork1.Level3.net (4.68.110.74)  27.183 ms  29.517
> ms  29.478 ms
>  7  ae-3.r07.nycmny01.us.bb.gin.ntt.net (129.250.6.176)  29.465 ms
> 27.722 ms  27.057 ms
>  8  xe-0-1-0-22.r07.nycmny01.us.ce.gin.ntt.net (128.241.2.22)  30.178 ms
> 29.213 ms  29.185 ms
>  9  501.xe-0-2-0.core-01-ewr.as33517.net (162.88.245.253)  25.818 ms
> 26.573 ms  26.558 ms
> 10  hivecast-111-usnbn.as15135.net (108.59.174.68)  26.545 ms
> hivecast-119-usnbn.as15135.net (108.59.174.70)  26.527 ms
> hivecast-111-usnbn.as15135.net (108.59.174.68)  26.490 ms
> 11  ns1.p16.dynect.net (208.78.70.16)  2306.252 ms  2306.207 ms  1581.852
> ms
>
> # this was from the Comcast Business connection at work - I had pulled an
> IP address for another one of their name servers
> $ traceroute 208.78.70.11
> traceroute to 208.78.70.11 (208.78.70.11), 30 hops max, 60 byte packets
>  1  10.1.10.1 (10.1.10.1)  0.519 ms  1.436 ms  1.841 ms
>  2  96.120.41.213 (96.120.41.213)  12.928 ms  13.907 ms  14.387 ms
>  3  xe-10-3-1-sur04.royaloak.mi.michigan.comcast.net (69.139.249.153)
> 14.119 ms  14.224 ms  18.408 ms
>  4  te-0-2-0-9-ar02.taylor.mi.michigan.comcast.net (68.87.189.141)
> 19.690 ms  20.746 ms  20.928 ms
>  5  be-33668-cr02.350ecermak.il.ibone.comcast.net (68.86.90.45)  28.361
> ms  27.143 ms  28.124 ms
>  6  ix-xe-4-0-4-0.tcore1.CT8-Chicago.as6453.net (64.86.137.29)  25.479
> ms  19.895 ms  16.959 ms
>  7  if-ae-22-2.tcore2.CT8-Chicago.as6453.net (64.86.79.1)  24.365 ms
> 24.147 ms  24.229 ms
>  8  64.86.79.94 (64.86.79.94)  23.585 ms  23.916 ms  23.773 ms
>  9  hivecast-127-usord.as15135.net (162.88.117.10)  22.380 ms
> hivecast-103-usord.as15135.net (162.88.117.5)  35.294 ms
> hivecast-126-usord.as15135.net (162.88.117.9)  26.345 ms
> 10  * * *
> 11  * * *
> 12  * * *
> 13  * * *
> 14  * * *
> 15  *^C
>
>
> _______________________________________________
> Outages mailing list
> Outages at outages.org
> https://puck.nether.net/mailman/listinfo/outages
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://puck.nether.net/pipermail/outages/attachments/20161021/a303461a/attachment.htm>